Skip to content

Commit cc1fa53

Browse files
edewataedewata
committed
wip
1 parent 8a898ea commit cc1fa53

File tree

8 files changed

+231
-80
lines changed

8 files changed

+231
-80
lines changed

‎.github/workflows/tomcat-https-default-test.yml

+53
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,20 @@ jobs:
5656
run: |
5757
docker cp /tmp/RPMS/. server:/root/RPMS/
5858
docker exec server bash -c "dnf install -y /root/RPMS/*"
59+
docker exec server dnf install -y xmlstarlet
5960
6061
- name: Create Tomcat
6162
run: |
6263
docker exec server pki-server create -v
6364
65+
- name: Configure JSS logging
66+
run: |
67+
docker exec server sed -i \
68+
"s/^\(org.mozilla.jss.level\) *=.*/\1 = INFO/" \
69+
/var/lib/pki/pki-tomcat/conf/logging.properties
70+
71+
docker exec server cat /var/lib/pki/pki-tomcat/conf/logging.properties
72+
6473
- name: Create NSS database in Tomcat
6574
run: |
6675
docker exec server pki-server nss-create --no-password
@@ -151,6 +160,8 @@ jobs:
151160
-d '/document/ssltest/*[not(self::protocol)]' \
152161
sslscan.xml | tee actual
153162
163+
diff expected actual
164+
154165
- name: Check ciphers
155166
run: |
156167
# only TLS1.2 and TLS 1.3 ciphers should be supported
@@ -247,6 +258,48 @@ jobs:
247258
248259
diff expected actual
249260
261+
- name: Set ciphers to TLS_AES_256_GCM_SHA384
262+
run: |
263+
docker exec server xmlstarlet edit --inplace \
264+
-u "//SSLHostConfig/@ciphers" \
265+
-v "TLS_AES_256_GCM_SHA384" \
266+
-i "//SSLHostConfig[not(@ciphers)]" \
267+
-t attr \
268+
-n "ciphers" \
269+
-v "TLS_AES_256_GCM_SHA384" \
270+
/etc/pki/pki-tomcat/server.xml
271+
272+
docker exec server cat /etc/pki/pki-tomcat/server.xml
273+
274+
- name: Restart Tomcat
275+
run: |
276+
docker exec server pki-server restart --wait -v
277+
278+
- name: Run sslscan
279+
run: |
280+
docker exec client sslscan \
281+
--xml=$SHARED/sslscan.xml \
282+
server.example.com:8443
283+
cat sslscan.xml
284+
285+
- name: Check ciphers
286+
run: |
287+
cat > expected << EOF
288+
<?xml version="1.0" encoding="UTF-8"?>
289+
<document>
290+
<ssltest host="server.example.com" sniname="server.example.com" port="8443">
291+
<cipher status="accepted" sslversion="TLSv1.3" bits="256" cipher="TLS_AES_256_GCM_SHA384" id="0x1302" strength="strong" curve="25519" ecdhebits="253"/>
292+
</ssltest>
293+
</document>
294+
EOF
295+
296+
xmlstarlet ed \
297+
-d '/document/@*' \
298+
-d '/document/ssltest/*[not(self::cipher)]' \
299+
sslscan.xml | tee actual
300+
301+
diff expected actual
302+
250303
- name: Stop Tomcat
251304
run: |
252305
docker exec server pki-server stop --wait -v

‎base/src/main/java/org/mozilla/jss/provider/javax/net/JSSContextSpi.java

+21-13
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,28 @@
11
package org.mozilla.jss.provider.javax.net;
22

3-
import java.security.*;
3+
import java.security.KeyManagementException;
4+
import java.security.SecureRandom;
45
import java.util.ArrayList;
56

6-
import javax.net.ssl.*;
7-
8-
import org.slf4j.Logger;
9-
import org.slf4j.LoggerFactory;
7+
import javax.net.ssl.KeyManager;
8+
import javax.net.ssl.SSLContextSpi;
9+
import javax.net.ssl.SSLEngine;
10+
import javax.net.ssl.SSLParameters;
11+
import javax.net.ssl.SSLServerSocketFactory;
12+
import javax.net.ssl.SSLSessionContext;
13+
import javax.net.ssl.SSLSocketFactory;
14+
import javax.net.ssl.TrustManager;
15+
import javax.net.ssl.X509TrustManager;
1016

1117
import org.mozilla.jss.provider.javax.crypto.JSSKeyManager;
18+
import org.mozilla.jss.ssl.SSLVersion;
1219
import org.mozilla.jss.ssl.javax.JSSEngine;
1320
import org.mozilla.jss.ssl.javax.JSSEngineReferenceImpl;
1421
import org.mozilla.jss.ssl.javax.JSSParameters;
1522
import org.mozilla.jss.ssl.javax.JSSServerSocketFactory;
1623
import org.mozilla.jss.ssl.javax.JSSSocketFactory;
17-
import org.mozilla.jss.ssl.SSLVersion;
24+
import org.slf4j.Logger;
25+
import org.slf4j.LoggerFactory;
1826

1927
public class JSSContextSpi extends SSLContextSpi {
2028
public static Logger logger = LoggerFactory.getLogger(JSSContextSpi.class);
@@ -26,7 +34,7 @@ public class JSSContextSpi extends SSLContextSpi {
2634

2735
@Override
2836
public void engineInit(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) throws KeyManagementException {
29-
logger.debug("JSSContextSpi.engineInit(" + kms + ", " + tms + ", " + sr + ")");
37+
logger.warn("JSSContextSpi.engineInit(" + kms + ", " + tms + ", " + sr + ")");
3038

3139
if (kms != null) {
3240
for (KeyManager km : kms) {
@@ -51,7 +59,7 @@ public void engineInit(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) th
5159

5260
@Override
5361
public SSLEngine engineCreateSSLEngine() {
54-
logger.debug("JSSContextSpi.engineCreateSSLEngine()");
62+
logger.warn("JSSContextSpi.engineCreateSSLEngine()");
5563

5664
JSSEngine ret = new JSSEngineReferenceImpl();
5765
initializeEngine(ret);
@@ -61,7 +69,7 @@ public SSLEngine engineCreateSSLEngine() {
6169

6270
@Override
6371
public SSLEngine engineCreateSSLEngine(String host, int port) {
64-
logger.debug("JSSContextSpi.engineCreateSSLEngine(" + host + ", " + port + ")");
72+
logger.warn("JSSContextSpi.engineCreateSSLEngine(" + host + ", " + port + ")");
6573

6674
JSSEngine ret = new JSSEngineReferenceImpl(host, port);
6775
initializeEngine(ret);
@@ -80,13 +88,13 @@ private void initializeEngine(JSSEngine eng) {
8088

8189
@Override
8290
public SSLSessionContext engineGetClientSessionContext() {
83-
logger.debug("JSSContextSpi.engineGetClientSessionContext() - not implemented");
91+
logger.warn("JSSContextSpi.engineGetClientSessionContext() - not implemented");
8492
return null;
8593
}
8694

8795
@Override
8896
public SSLSessionContext engineGetServerSessionContext() {
89-
logger.debug("JSSContextSpi.engineGetServerSessionContext() - not implemented");
97+
logger.warn("JSSContextSpi.engineGetServerSessionContext() - not implemented");
9098
return null;
9199
}
92100

@@ -97,7 +105,7 @@ public SSLServerSocketFactory engineGetServerSocketFactory() {
97105
protocol = protocol_version.jdkAlias();
98106
}
99107

100-
logger.debug("JSSContextSpi.engineGetServerSocketFactory() @ " + protocol);
108+
logger.warn("JSSContextSpi.engineGetServerSocketFactory() @ " + protocol);
101109
return new JSSServerSocketFactory(protocol, key_manager, trust_managers);
102110
}
103111

@@ -108,7 +116,7 @@ public SSLSocketFactory engineGetSocketFactory() {
108116
protocol = protocol_version.jdkAlias();
109117
}
110118

111-
logger.debug("JSSContextSpi.engineGetSocketFactory() @ " + protocol);
119+
logger.warn("JSSContextSpi.engineGetSocketFactory() @ " + protocol);
112120
return new JSSSocketFactory(protocol, key_manager, trust_managers);
113121
}
114122

‎base/src/main/java/org/mozilla/jss/ssl/javax/JSSEngine.java

+22-3
Original file line numberDiff line numberDiff line change
@@ -371,6 +371,9 @@ public JSSParameters getSSLParameters() {
371371
*/
372372
@Override
373373
public void setSSLParameters(SSLParameters params) {
374+
375+
logger.warn("JSSEngine: setSSLParameters()");
376+
374377
JSSParameters parsed;
375378

376379
// Try to cast the passed parameter into a JSSParameters. This has
@@ -517,6 +520,14 @@ public void setCertFromAlias(String alias) throws IllegalArgumentException {
517520
*/
518521
@Override
519522
public void setEnabledCipherSuites(String[] suites) throws IllegalArgumentException {
523+
524+
logger.warn("JSSEngine: setEnabledCipherSuites()");
525+
if (suites != null) {
526+
for (String suite : suites) {
527+
logger.warn("JSSEngine: - " + suite);
528+
}
529+
}
530+
520531
JSSParameters parser = new JSSParameters();
521532
parser.setCipherSuites(suites);
522533

@@ -528,6 +539,14 @@ public void setEnabledCipherSuites(String[] suites) throws IllegalArgumentExcept
528539
* instances.
529540
*/
530541
public void setEnabledCipherSuites(SSLCipher[] suites) throws IllegalArgumentException {
542+
543+
logger.warn("JSSEngine: setEnabledCipherSuites()");
544+
if (suites != null) {
545+
for (SSLCipher suite : suites) {
546+
logger.warn("JSSEngine: - " + suite);
547+
}
548+
}
549+
531550
if (ssl_fd != null) {
532551
String msg = "Unable to process setEnabledCipherSuites(...) ";
533552
msg += "after handshake has started!";
@@ -639,11 +658,11 @@ public String[] getSupportedCipherSuites() {
639658
*/
640659
@Override
641660
public void setEnabledProtocols(String[] protocols) throws IllegalArgumentException {
642-
logger.debug("JSSEngine: setEnabledProtocols(");
661+
logger.warn("JSSEngine: setEnabledProtocols(");
643662
for (String protocol : protocols) {
644-
logger.debug("\t" + protocol + ",");
663+
logger.warn("\t" + protocol + ",");
645664
}
646-
logger.debug(")");
665+
logger.warn(")");
647666

648667
JSSParameters parser = new JSSParameters();
649668
parser.setProtocols(protocols);

‎base/src/main/java/org/mozilla/jss/ssl/javax/JSSParameters.java

+20-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,16 @@
11
package org.mozilla.jss.ssl.javax;
22

3-
import javax.net.ssl.*;
4-
import java.util.*;
3+
import java.util.ArrayList;
4+
import java.util.Collection;
5+
import java.util.EventListener;
56

6-
import org.mozilla.jss.ssl.*;
7+
import javax.net.ssl.SSLParameters;
8+
9+
import org.mozilla.jss.ssl.SSLCipher;
10+
import org.mozilla.jss.ssl.SSLVersion;
11+
import org.mozilla.jss.ssl.SSLVersionRange;
12+
import org.slf4j.Logger;
13+
import org.slf4j.LoggerFactory;
714

815
/**
916
* JSSParameters is an implementation of SSLParameters to interoperate
@@ -22,6 +29,9 @@
2229
* used to find the certificate.
2330
*/
2431
public class JSSParameters extends SSLParameters {
32+
33+
public static Logger logger = LoggerFactory.getLogger(JSSParameters.class);
34+
2535
private SSLCipher[] suites;
2636
private SSLVersionRange range;
2737
private String alias;
@@ -72,6 +82,13 @@ public void setCipherSuites(String[] cipherSuites) throws IllegalArgumentExcepti
7282
return;
7383
}
7484

85+
logger.warn("JSSParameters: setEnabledCipherSuites()");
86+
if (suites != null) {
87+
for (String suite : cipherSuites) {
88+
logger.warn("JSSParameters: - " + suite);
89+
}
90+
}
91+
7592
ArrayList<SSLCipher> converted = new ArrayList<>();
7693
for (String cipherSuite : cipherSuites) {
7794
try {

‎tomcat-9.0/src/main/java/org/dogtagpki/jss/tomcat/JSSContext.java

+10-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public void init(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) throws K
6060

6161
@Override
6262
public javax.net.ssl.SSLEngine createSSLEngine() {
63-
logger.debug("JSSContext.createSSLEngine()");
63+
logger.warn("JSSContext.createSSLEngine()");
6464
javax.net.ssl.SSLEngine eng = ctx.createSSLEngine();
6565

6666
TomcatJSS instance = TomcatJSS.getInstance();
@@ -71,6 +71,15 @@ public javax.net.ssl.SSLEngine createSSLEngine() {
7171
if(instance != null) {
7272
j_eng.setListeners(instance.getSocketListeners());
7373
}
74+
75+
//String[] ciphers = instance.getCiphers();
76+
//logger.warn("JSSContext.setEnabledCipherSuites()");
77+
//if (ciphers != null) {
78+
// for (String cipher : ciphers) {
79+
// logger.warn("JSSContext: - " + cipher);
80+
// }
81+
//}
82+
//j_eng.setEnabledCipherSuites(ciphers);
7483
}
7584

7685
return eng;

‎tomcat-9.0/src/main/java/org/dogtagpki/jss/tomcat/JSSNioEndpoint.java

+19-2
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import org.apache.tomcat.util.ExceptionUtils;
5454
import org.apache.tomcat.util.net.NioChannel;
5555
import org.apache.tomcat.util.net.NioEndpoint;
56+
import org.apache.tomcat.util.net.SSLHostConfig;
5657
import org.apache.tomcat.util.net.SocketBufferHandler;
5758
import org.apache.tomcat.util.net.openssl.ciphers.Cipher;
5859

@@ -126,8 +127,24 @@ protected boolean setSocketOptions(SocketChannel socket) {
126127

127128
}
128129
@Override
129-
protected SSLEngine createSSLEngine(String arg0, List<Cipher> arg1, List<String> arg2) {
130-
return super.createSSLEngine(arg0, arg1, arg2);
130+
protected SSLEngine createSSLEngine(
131+
String sniHostName,
132+
List<Cipher> clientRequestedCiphers,
133+
List<String> clientRequestedApplicationProtocols) {
134+
135+
log.warn("JSSNioEndpoint: createSSLEngine()");
136+
log.warn("JSSNioEndpoint: - SNI hostname: " + sniHostName);
137+
138+
SSLHostConfig sslHostConfig = getSSLHostConfig(sniHostName);
139+
log.warn("JSSNioEndpoint: - ciphers:");
140+
String[] ciphers = sslHostConfig.getEnabledCiphers();
141+
if (ciphers != null) {
142+
for (String cipher : ciphers) {
143+
log.warn("JSSNioEndpoint: - " + cipher);
144+
}
145+
}
146+
147+
return super.createSSLEngine(sniHostName, clientRequestedCiphers, clientRequestedApplicationProtocols);
131148
}
132149

133150
}

0 commit comments

Comments
 (0)